Description

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to read, write, or delete arbitrary files due to a path traversal vulnerability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-14T20:16:40.270Z",
  "pubdate": "2026-09-14T20:16:40.270Z",
  "executiveSummary": "A critical path traversal vulnerability has been identified in IBM DataStage on Cloud Pak for Data 5.4.0.0. This flaw allows a remote authenticated attacker to manipulate file path references, potentially resulting in unauthorized reading, writing, or deletion of arbitrary files within the underlying file system.\nThe vulnerability exists due to insufficient validation of user-supplied input when processing file-related operations, enabling attackers to bypass intended directory restrictions. By leveraging directory traversal sequences, such as '../', an attacker can escape the designated application directory to access sensitive system files or configuration data.\nThis vulnerability poses a significant risk to the integrity, confidentiality, and availability of the IBM DataStage environment. Successful exploitation requires the attacker to be authenticated to the system; however, once inside, the ability to modify or remove critical files can lead to complete service disruption or system compromise. Organizations utilizing IBM DataStage on Cloud Pak for Data 5.4.0.0 are advised to prioritize security hardening and monitor for unauthorized file access patterns.\nThe impact includes potential information disclosure of sensitive credentials or configuration files, the modification of system binaries or parameters to facilitate secondary attacks, and the destruction of data through unauthorized file deletion.",
  "technicalDetails": "The vulnerability is rooted in an improper implementation of input sanitization mechanisms within the IBM DataStage file-handling logic. Specifically, the application fails to adequately neutralize directory traversal characters, such as dot-dot-slash (../) sequences, when interpreting file paths provided in client-side requests.\nIn a standard execution flow, the application is expected to restrict file access to a specific, sandboxed directory tree. However, the lack of robust path normalization and validation allows an attacker to inject path traversal payloads into parameters that influence file system interactions. When the application processes these malicious inputs, it fails to verify that the resolved canonical path resides within the authorized directory boundary.\nThe exploitation process typically follows a structured attack flow. First, an authenticated attacker identifies a functionality within the DataStage interface that interacts with the file system, such as a file upload, download, or management component. Second, the attacker intercepts the request—typically via a proxy or custom API client—and modifies the path parameter. By substituting a standard filename with a sequence such as '../../etc/passwd' or other system-specific configuration files, the attacker directs the application’s backend file system functions (e.g., fopen, delete, or file_put_contents) to targets outside the intended scope.\nThe component responsible for this vulnerability is the file processing module within the IBM DataStage application, which handles user-supplied file path information without sufficient canonicalization. Because the vulnerability allows for both read and write operations, the post-exploitation impact is severe. An attacker can read sensitive configuration files (potentially leading to privilege escalation) or overwrite existing system files to disrupt the stability of the Cloud Pak for Data environment.\nThe vulnerability is restricted to version 5.4.0.0 and necessitates that the attacker possesses valid authentication credentials. While the attack is authenticated, the impact is not limited by traditional role-based access controls once the file system level is reached, as the flaw operates at the application logic layer, bypassing typical authorization checks that would otherwise prevent access to sensitive paths. Network exposure is inherent to any exposed DataStage instance reachable by the attacker."
}